Threat actorhigh
New Cloud Atlas APT campaign
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | securemodem.com | containing the exploit was downloaded from the URL hxxps://securemodem[.]com?tzak.html_anacid . Template files, like HTA files, are lo |
| url | https://securemodem.com?tzak.html_anacid | RTF file containing the exploit was downloaded from the URL hxxps://securemodem[.]com?tzak.html_anacid . Template files, like HTA files, are located on servers |
From the original article
14 min read at securelist.com
Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process ( CVE-2018-0802 ) to download and execute malicious code.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.